CVE-2022-50788 | THREATINT

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files. Attackers can directly browse the /log directory to retrieve system and sensitive information without authentication.

PUBLISHED Reserved 2025-12-26 | Published 2025-12-30 | Updated 2025-12-30 | Assigner VulnCheck

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Exposure of Information Through Directory Listing

Product status

Version 2: 1.1/2.15

affected

1.16

affected

1.2

affected

1.30

affected

1.1/2.4.29

affected

1.11

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5732.php (Zero Science Lab Disclosure (ZSL-2022-5732)) third-party-advisory

packetstormsecurity.com/...o-2.x-Information-Disclosure.html (Packet Storm Security Exploit Details) exploit

exchange.xforce.ibmcloud.com/vulnerabilities/247921 (IBM X-Force Vulnerability Exchange Entry) vdb-entry

www.sound4.com/ (SOUND4 Product Homepage) product

www.vulncheck.com/...nformation-disclosure-via-log-directory (VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Information Disclosure via Log Directory) third-party-advisory

cve.org (CVE-2022-50788)

nvd.nist.gov (CVE-2022-50788)

Download JSON